CVE-2024-6522

moderate-risk
Published 2024-08-07

The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Do I need to act?

-
0.74% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.5/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Webnus

References (4)

Release Notes https://mec.webnus.net/change-log/
Product https://plugins.trac.wordpress.org/browser/modern-events-calendar-lite/trunk/app...
Product https://wordpress.org/plugins/modern-events-calendar-lite/#developers
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/00bf8f2f-6ab4-4430-800...
38
/ 100
moderate-risk
Severity 29/34 · Critical
Exploitability 2/34 · Minimal
Exposure 7/34 · Low